IBM Support

Security Bulletin: Vulnerability in Apache Commons might affect WebSphere Industry Content Packs and IBM Business Process Manager Industry Packs (CVE-2015-7450)

Created by Jens Engelke on
Published URL:
https://www.ibm.com/support/pages/node/273063
273063

Security Bulletin


Summary

A vulnerability for handling Java object deserialization in the Apache Commons Collections open source library has been reported. A vulnerable version of the library is included in templates shipped with WebSphere Industry Content Packs and IBM Business Process Manager Industry Packs.

Vulnerability Details

CVEID: CVE-2015-7450
DESCRIPTION: Apache Commons Collections could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of data with Java InvokerTransformer class. By sending specially crafted data, an attacker could exploit this vulnerability to execute arbitrary Java code on the system.
CVSS Base Score: 9.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/107918 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

  • WebSphere Industry Content Packs 7.0.0.0 through 7.0.0.3
  • IBM Business Process Manager Industry Packs 7.5.x

Remediation/Fixes

Artifacts contained in WebSphere Industry Content Packs and IBM Business Process Manager Industry Packs can be customized and deployed on server products running on top of IBM WebSphere Application Server V7. Please review Security Bulletin: Vulnerability in Apache Commons affects IBM WebSphere Application Server (CVE-2015-7450) and download and install the suggested fixes.

Workarounds and Mitigations

When building your own applications based on the templates provided in WebSphere Industry Content Packs and IBM Business Process Manager Industry Packs, make sure to include the latest version of Apache Commons Collections and remove all other versions. Specifically, replace commons-collections-3.2.1.jar with commons-collections-3.2.2.jar in all existing and new applications.

A patched version is available for download on Apache's proceject web site: https://commons.apache.org/proper/commons-collections/download_collections.cgi

IBM recommends that you review your entire environment to identify vulnerable releases of the open-source Apache Commons Collections and take appropriate mitigation and remediation actions.

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v2 Guide
On-line Calculator v2

Complete CVSS v3 Guide
On-line Calculator v3

Off

Related Information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Change History

2015-11-26 - initial version published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

[{"Product":{"code":"SSCNZQ","label":"WebSphere Industry Content Packs"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":"Security","Platform":[{"code":"PF033","label":"Windows"}],"Version":"7.0.0.3;7.0.0.2;7.0.0.1;7.0","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Product":{"code":"SS7LVH","label":"IBM Business Process Manager Industry Packs"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":"General","Platform":[{"code":"PF033","label":"Windows"}],"Version":"7.5","Edition":"","Line of Business":{"code":"LOB36","label":"IBM Automation"}}]

Document Information

Modified date:
15 June 2018

UID

swg21971847

Page Feedback